PATH

What is PATH?#

When you type ls, the shell searches each directory in $PATH in order and runs the first match. Programs that invoke other commands by bare name inherit this behaviour.

Why LinPEAS checks path#

LinPEAS prints PATH and flags writable entries and any current directory (.) in it, because these enable command-shadowing against SUID binaries, cron jobs and systemd units that call commands by name.

What a normal configuration looks like#

PATH contains standard system directories (/usr/local/bin, /usr/bin, /bin, /sbin) that only root can write to, and no . entry.

Why it can be security-sensitive#

A writable directory early in root's PATH, or a . entry, means a privileged process that runs a bare command name can be tricked into running your file instead. Combined with a SUID binary that calls, say, service without a full path, this is a direct root path.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

echo $PATH

for d in ${PATH//:/ }; do [ -w "$d" ] && echo "writable: $d"; done

echo $PATH | tr ":" "\n" | grep -n "^\.$"

Defensive remediation#

• Remove writable and '.' entries from privileged PATHs.
• Set an explicit, minimal PATH in cron and systemd units.
• Have privileged programs call other commands by absolute path.